Page 202 - BAM ONE REPORT 2564 (ENGLISH VERSION)

200 Part 2
Corporate Governance
approved an organization restructuring to
accommodate the long-term strategic plan
by reorganizing the back-office group and
additionally setting up the “Corporate
Governance and Risk Management Group” to
elevate the governance, risk and compliance
(GRC) operations, consisting of Corporate
Governance and Compliance Department and
Risk Management Department.
1.3 Determination of the scope of authority,
duties and responsibilities of the Board of
Directors, the Audit Committee, and Chief
Executive Officer, and determination of
the approval authority for the Company’s
operations and transactions.
1.4 Giving of importance to the integration of
GRC operations of work units in the first,
second and third lines in order to move the
organization towards sustainable growth.
1.5 Formulation of the governance, risk and
compliance (GRC) policy.
1.6 Preparation of handbooks for good corporate
governance and corporate social responsibility,
business ethics, and corporate governance
practices, such as provision of complaint
channels, reporting of conflict of interest, and
the Company being approved to participate
in Thailand’s Private Sector Collective Action
Coalition Against Corruption (“CAC”), which
enables the Company to attain the corporate
governance standards and achieve efficient
management and also helps to boost employees’
morale and good spirit in performing the
assigned duties to their full capacity.
1.7 Creation of tools for the Company’s human
resource development reporting in order to
develop employees’ capabilities that align
with the Company’s operational direction.
1.8 Giving of importance to data governance by
appointing the Data Governance Working
Committee to supervise and oversee the
Company’s data management to be carried
on appropriately and efficiently.
1.9 Formulation of the data governance policy
and the data governance guidelines.
1.10 Upgrade of risk management work into Risk
Management Department, consisting of
Enterprise Risk Management Division, Risk
Management and Information Technology
Regulation Governance Division, and Personal
Data Protection Supporting Division, in order
to elevate risk management to the international
standard, which is under the supervision of
Corporate Governance and Risk Management
Group.
1.11 Formulation of the outsourcing guidelines
for all departments to abide by.
1.12 Review and revision of the enterprise risk
management policy, covering six key risk
categories which are strategic risk, operational
risk, financial risk, compliance risk, reputation
risk, and information technology risk, in order
to manage risks to stay at the risk appetite
level of the Company.
1.13 Formulation of the IT risk management policy
and the IT risk management guidelines in order
to raise the Company’s IT risk management
standard.
1.14 Determination of IT key risk indicators (IT KRIs)
in order to follow up on the outcomes of IT
risk management to align with BAM digital
enterprise development (BAM-D).
1.15 Formulation of the IT outsourcing guidelines
for all departments to use as a basis for their
IT risk assessment and to be aware of the
Company’s IT security.